@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.12

package/dist/chunk-YMVQD5Q5.js

@@ -1,453 +0,0 @@
-import {
-  SCHEMAS_COLLECTION
-} from "./chunk-T7WSLRAU.js";
-import {
-  BLOB_CHUNKS_COLLECTION,
-  BLOB_COLLECTION,
-  BLOB_INDEX_COLLECTION,
-  BLOB_SLOTS_PREFIX,
-  BLOB_VERSIONS_PREFIX
-} from "./chunk-XH7XP3OL.js";
-import {
-  assembleBundleContainer,
-  buildExtractedPartitionWrapper
-} from "./chunk-QSFOZUYL.js";
-import {
-  generateULID
-} from "./chunk-ZJADGNYF.js";
-import {
-  LEDGER_COLLECTION
-} from "./chunk-I7FD46FF.js";
-import {
-  canonicalJson,
-  envelopePayloadHash,
-  hashEntry
-} from "./chunk-UF362QVH.js";
-import {
-  openEnvelopeJson
-} from "./chunk-MCHVVJIA.js";
-import {
-  bufferToBase64,
-  decrypt,
-  decryptBytesWithAAD,
-  encrypt,
-  encryptBytesWithAAD,
-  generateDEK,
-  unwrapCek,
-  wrapCek
-} from "./chunk-3OPY6MK2.js";
-import {
-  NOYDB_BACKUP_VERSION,
-  NOYDB_FORMAT_VERSION
-} from "./chunk-YN5IAHN6.js";
-import {
-  PartitionExtractionError
-} from "./chunk-S7VFUQM2.js";
-
-// src/with-cargo/walk-closure.ts
-async function walkClosure(vault, opts) {
-  const closure = /* @__PURE__ */ new Map();
-  const requireStringId = (collection, record) => {
-    const id = record["id"];
-    if (typeof id !== "string") {
-      throw new PartitionExtractionError(
-        `walkClosure: record in collection "${collection}" has a non-string id (${typeof id}); cannot include it in the partition closure.`
-      );
-    }
-    return id;
-  };
-  const add = (collection, id) => {
-    let set = closure.get(collection);
-    if (!set) {
-      set = /* @__PURE__ */ new Set();
-      closure.set(collection, set);
-    }
-    if (set.has(id)) return false;
-    set.add(id);
-    return true;
-  };
-  for (const [collectionName, predicate] of Object.entries(opts.seeds)) {
-    const coll = vault.collection(collectionName);
-    const records = await coll.list();
-    for (const record of records) {
-      if (await predicate(record)) {
-        add(collectionName, requireStringId(collectionName, record));
-      }
-    }
-  }
-  const { refRegistry } = vault._introspectState();
-  const maxDepth = opts.maxDepth ?? 16;
-  let cyclesDetected = false;
-  let inboundDepth = 0;
-  let outboundDepth = 0;
-  let frontier = [];
-  for (const [c, ids] of closure) for (const id of ids) frontier.push([c, id]);
-  while (frontier.length > 0) {
-    const next = [];
-    for (const [collectionName, id] of frontier) {
-      for (const inbound of refRegistry.getInbound(collectionName)) {
-        const childColl = vault.collection(inbound.collection);
-        const childRecords = await childColl.list();
-        for (const child of childRecords) {
-          const fk = child[inbound.field];
-          if (typeof fk !== "string" && typeof fk !== "number") continue;
-          if (String(fk) !== id) continue;
-          const childId = requireStringId(inbound.collection, child);
-          if (add(inbound.collection, childId)) {
-            next.push([inbound.collection, childId]);
-          } else {
-            cyclesDetected = true;
-          }
-        }
-      }
-    }
-    if (next.length > 0 && ++inboundDepth > maxDepth) {
-      throw new PartitionExtractionError(
-        `walkClosure exceeded maxDepth=${maxDepth}; the FK graph may be unexpectedly deep or cyclic. Raise maxDepth or narrow the seeds.`
-      );
-    }
-    frontier = next;
-  }
-  let outboundFrontier = [];
-  for (const [c, ids] of closure) for (const id of ids) outboundFrontier.push([c, id]);
-  while (outboundFrontier.length > 0) {
-    const next = [];
-    for (const [collectionName, id] of outboundFrontier) {
-      const outbound = refRegistry.getOutbound(collectionName);
-      if (Object.keys(outbound).length === 0) continue;
-      const coll = vault.collection(collectionName);
-      const record = await coll.get(id);
-      if (!record) continue;
-      for (const [field, descriptor] of Object.entries(outbound)) {
-        const rawId = record[field];
-        if (typeof rawId !== "string" && typeof rawId !== "number") continue;
-        const parentId = String(rawId);
-        if (add(descriptor.target, parentId)) {
-          next.push([descriptor.target, parentId]);
-        }
-      }
-    }
-    if (next.length > 0 && ++outboundDepth > maxDepth) {
-      throw new PartitionExtractionError(
-        `walkClosure exceeded maxDepth=${maxDepth} during outbound completion.`
-      );
-    }
-    outboundFrontier = next;
-  }
-  const depth = Math.max(inboundDepth, outboundDepth);
-  return { closure, graph: { depth, cyclesDetected } };
-}
-
-// src/with-cargo/extract-partition.ts
-async function reKeyClosure(vault, closure, fieldProjection) {
-  const { name: vaultName, adapter, getDEK } = vault._introspectState();
-  const collections = {};
-  const deks = /* @__PURE__ */ new Map();
-  for (const [collectionName, ids] of closure) {
-    const srcDek = await getDEK(collectionName);
-    const destDek = await generateDEK();
-    deks.set(collectionName, destDek);
-    const out = {};
-    const projList = fieldProjection?.[collectionName];
-    const proj = projList ? new Set(projList) : void 0;
-    const project = (plaintext) => {
-      if (!proj) return plaintext;
-      const rec = JSON.parse(plaintext);
-      const kept = {};
-      if ("id" in rec) kept["id"] = rec["id"];
-      for (const f of proj) if (f in rec) kept[f] = rec[f];
-      return JSON.stringify(kept);
-    };
-    for (const id of ids) {
-      const env = await adapter.get(vaultName, collectionName, id);
-      if (!env) continue;
-      if (env._cek !== void 0) {
-        const cek = await unwrapCek(env._cek, srcDek);
-        const plaintext2 = await decrypt(env._iv, env._data, cek);
-        const { iv: iv2, data: data2 } = await encrypt(project(plaintext2), cek);
-        const wrapped = await wrapCek(cek, destDek);
-        out[id] = { ...env, _iv: iv2, _data: data2, _cek: wrapped };
-        continue;
-      }
-      const plaintext = await openEnvelopeJson(env, srcDek);
-      const { iv, data } = await encrypt(project(plaintext), destDek);
-      out[id] = { ...env, _iv: iv, _data: data };
-    }
-    collections[collectionName] = out;
-  }
-  return { collections, deks };
-}
-async function reKeySchemas(vault, closure, destDeks, fieldProjection) {
-  const { name: vaultName, adapter, getDEK } = vault._introspectState();
-  const out = {};
-  for (const collectionName of closure.keys()) {
-    if (fieldProjection?.[collectionName]) continue;
-    const env = await adapter.get(vaultName, SCHEMAS_COLLECTION, collectionName);
-    if (!env) continue;
-    const destDek = destDeks.get(collectionName);
-    if (!destDek) continue;
-    const srcDek = await getDEK(collectionName);
-    const plaintext = await openEnvelopeJson(env, srcDek);
-    const { iv, data } = await encrypt(plaintext, destDek);
-    out[collectionName] = { ...env, _iv: iv, _data: data };
-  }
-  return out;
-}
-var paddedIndex = (n) => String(n).padStart(10, "0");
-async function reKeyLedger(vault, closure, reKeyedCollections, ledgerDek) {
-  const { name: vaultName, adapter, getDEK } = vault._introspectState();
-  const srcLedgerDek = await getDEK(LEDGER_COLLECTION);
-  const ids = (await adapter.list(vaultName, LEDGER_COLLECTION)).sort();
-  const srcEntries = [];
-  for (const id of ids) {
-    const env = await adapter.get(vaultName, LEDGER_COLLECTION, id);
-    if (!env) continue;
-    srcEntries.push(JSON.parse(await openEnvelopeJson(env, srcLedgerDek)));
-  }
-  const kept = srcEntries.filter(
-    (e) => (e.op === "put" || e.op === "delete") && (closure.get(e.collection)?.has(e.id) ?? false)
-  );
-  const latestPutIndex = /* @__PURE__ */ new Map();
-  for (let i = kept.length - 1; i >= 0; i--) {
-    const e = kept[i];
-    if (e.op !== "put") continue;
-    const key = `${e.collection}/${e.id}`;
-    if (!latestPutIndex.has(key)) latestPutIndex.set(key, i);
-  }
-  const entries = {};
-  let prevHash = "";
-  let last;
-  for (let i = 0; i < kept.length; i++) {
-    const src = kept[i];
-    const key = `${src.collection}/${src.id}`;
-    const isLatestPut = src.op === "put" && latestPutIndex.get(key) === i;
-    const reKeyedEnv = reKeyedCollections[src.collection]?.[src.id];
-    const payloadHash = isLatestPut && reKeyedEnv ? await envelopePayloadHash(reKeyedEnv) : src.payloadHash;
-    const entry = {
-      index: i,
-      prevHash,
-      op: src.op,
-      collection: src.collection,
-      id: src.id,
-      version: src.version,
-      ts: src.ts,
-      actor: src.actor,
-      payloadHash,
-      ...src.reason !== void 0 ? { reason: src.reason } : {}
-    };
-    const { iv, data } = await encrypt(canonicalJson(entry), ledgerDek);
-    entries[paddedIndex(i)] = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: i + 1,
-      _ts: entry.ts,
-      _iv: iv,
-      _data: data,
-      _by: entry.actor
-    };
-    prevHash = await hashEntry(entry);
-    last = entry;
-  }
-  return {
-    entries,
-    head: last ? { hash: prevHash, index: last.index, ts: last.ts } : { hash: "", index: -1, ts: "" }
-  };
-}
-function chunkAAD(eTag, chunkIndex, chunkCount) {
-  return new TextEncoder().encode(`${eTag}:${chunkIndex}:${chunkCount}`);
-}
-async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
-  const { name: vaultName, adapter, getDEK } = vault._introspectState();
-  const internal = {};
-  const carriedRefs = /* @__PURE__ */ new Map();
-  const addRef = (eTag) => {
-    if (!eTag) return;
-    carriedRefs.set(eTag, (carriedRefs.get(eTag) ?? 0) + 1);
-  };
-  const place = (collection, id, env) => {
-    let bucket = internal[collection];
-    if (!bucket) {
-      bucket = {};
-      internal[collection] = bucket;
-    }
-    bucket[id] = env;
-  };
-  for (const [collectionName, ids] of closure) {
-    const destDek = destDeks.get(collectionName);
-    if (!destDek) continue;
-    const srcDek = await getDEK(collectionName);
-    const projList = fieldProjection?.[collectionName];
-    const proj = projList ? new Set(projList) : void 0;
-    const slotsCollection = `${BLOB_SLOTS_PREFIX}${collectionName}`;
-    for (const id of ids) {
-      const env = await adapter.get(vaultName, slotsCollection, id);
-      if (!env) continue;
-      const slots = JSON.parse(await openEnvelopeJson(env, srcDek));
-      const kept = {};
-      for (const [slotName, slot] of Object.entries(slots)) {
-        if (proj && !proj.has(slotName)) continue;
-        kept[slotName] = slot;
-        addRef(slot.eTag);
-      }
-      if (Object.keys(kept).length === 0) continue;
-      const { iv, data } = await encrypt(JSON.stringify(kept), destDek);
-      place(slotsCollection, id, { ...env, _iv: iv, _data: data });
-    }
-    const versionsCollection = `${BLOB_VERSIONS_PREFIX}${collectionName}`;
-    const versionKeys = await adapter.list(vaultName, versionsCollection);
-    for (const key of versionKeys) {
-      const [recordId, slotName] = key.split("::");
-      if (recordId === void 0 || !ids.has(recordId)) continue;
-      if (proj && slotName !== void 0 && !proj.has(slotName)) continue;
-      const env = await adapter.get(vaultName, versionsCollection, key);
-      if (!env) continue;
-      const record = JSON.parse(await openEnvelopeJson(env, srcDek));
-      addRef(record.eTag);
-      const { iv, data } = await encrypt(JSON.stringify(record), destDek);
-      place(versionsCollection, key, { ...env, _iv: iv, _data: data });
-    }
-  }
-  if (carriedRefs.size === 0) return { internal };
-  const srcBlobDek = await getDEK(BLOB_COLLECTION);
-  const transferBlobDek = await generateDEK();
-  for (const [eTag, refCount] of carriedRefs) {
-    const idxEnv = await adapter.get(vaultName, BLOB_INDEX_COLLECTION, eTag);
-    if (!idxEnv) continue;
-    const blob = JSON.parse(await openEnvelopeJson(idxEnv, srcBlobDek));
-    let contentCek;
-    let chunksPassthrough;
-    if (blob._cek !== void 0) {
-      contentCek = await unwrapCek(blob._cek, srcBlobDek);
-      chunksPassthrough = true;
-    } else {
-      contentCek = await generateDEK();
-      chunksPassthrough = false;
-    }
-    for (let i = 0; i < blob.chunkCount; i++) {
-      const chunkId = `${eTag}_${i}`;
-      const chunkEnv = await adapter.get(vaultName, BLOB_CHUNKS_COLLECTION, chunkId);
-      if (!chunkEnv) {
-        throw new PartitionExtractionError(
-          `reKeyBlobs: blob chunk ${i}/${blob.chunkCount} missing for eTag "${eTag}"; cannot carry an incomplete blob into the partition.`
-        );
-      }
-      if (chunksPassthrough) {
-        place(BLOB_CHUNKS_COLLECTION, chunkId, chunkEnv);
-      } else {
-        const aad = chunkAAD(eTag, i, blob.chunkCount);
-        const plain = await decryptBytesWithAAD(chunkEnv._iv, chunkEnv._data, srcBlobDek, aad);
-        const { iv: iv2, data: data2 } = await encryptBytesWithAAD(plain, contentCek, aad);
-        place(BLOB_CHUNKS_COLLECTION, chunkId, { ...chunkEnv, _iv: iv2, _data: data2 });
-      }
-    }
-    const { _cekPending, ...rest } = blob;
-    void _cekPending;
-    const carried = { ...rest, refCount, _cek: await wrapCek(contentCek, transferBlobDek) };
-    const { iv, data } = await encrypt(JSON.stringify(carried), transferBlobDek);
-    place(BLOB_INDEX_COLLECTION, eTag, { ...idxEnv, _iv: iv, _data: data });
-  }
-  return { internal, blobDek: transferBlobDek };
-}
-async function sealDeks(deks) {
-  const dekMap = {};
-  for (const [collection, dek] of deks) {
-    const raw = await crypto.subtle.exportKey("raw", dek);
-    dekMap[collection] = bufferToBase64(raw);
-  }
-  const transferKey = crypto.getRandomValues(new Uint8Array(32));
-  const key = await crypto.subtle.importKey("raw", transferKey, "AES-GCM", false, ["encrypt"]);
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const plaintext = new TextEncoder().encode(JSON.stringify(dekMap));
-  const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, plaintext);
-  const combined = new Uint8Array(iv.byteLength + ct.byteLength);
-  combined.set(iv, 0);
-  combined.set(new Uint8Array(ct), iv.byteLength);
-  const sealId = bufferToBase64(crypto.getRandomValues(new Uint8Array(12)));
-  return {
-    seal: { v: 1, alg: "aes-256-gcm-pre-shared", sealId, payload: bufferToBase64(combined) },
-    transferKey
-  };
-}
-async function extractPartition(vault, opts) {
-  return vault.cargoStrategy.extractPartition(vault, opts);
-}
-async function extractPartitionCore(vault, opts) {
-  if (vault.role === "custodian") {
-    throw new PartitionExtractionError(
-      "extractPartition is owner-only; a custodian cannot extract-and-sever (FR-6: producing a re-keyed standalone partition is an ownership operation; use the Deed owner)."
-    );
-  }
-  if (vault.role !== "owner") {
-    throw new PartitionExtractionError(
-      `extractPartition requires the 'owner' role on the source vault; caller is '${vault.role}'. Producing a re-keyed standalone partition is an ownership operation.`
-    );
-  }
-  if (opts.carrySchemas) await vault._drainPendingSchemaWrites();
-  const { closure } = await walkClosure(vault, opts);
-  const { collections, deks } = await reKeyClosure(vault, closure, opts.fieldProjection);
-  let ledgerHead;
-  let ledgerEntries;
-  if (opts.carryLedger && vault._getLedgerOrNull() !== null) {
-    const ledgerDek = await generateDEK();
-    const built = await reKeyLedger(vault, closure, collections, ledgerDek);
-    if (built.head.index >= 0) {
-      ledgerEntries = built.entries;
-      ledgerHead = built.head;
-      deks.set(LEDGER_COLLECTION, ledgerDek);
-    }
-  }
-  const blobs = await reKeyBlobs(vault, closure, deks, opts.fieldProjection);
-  if (blobs.blobDek) deks.set(BLOB_COLLECTION, blobs.blobDek);
-  const internalSchemas = opts.carrySchemas ? await reKeySchemas(vault, closure, deks, opts.fieldProjection) : {};
-  const internal = {};
-  if (Object.keys(internalSchemas).length > 0) internal[SCHEMAS_COLLECTION] = internalSchemas;
-  if (ledgerEntries) internal[LEDGER_COLLECTION] = ledgerEntries;
-  for (const [collection, records] of Object.entries(blobs.internal)) internal[collection] = records;
-  const hasInternal = Object.keys(internal).length > 0;
-  const { seal, transferKey } = await sealDeks(deks);
-  await vault._getLedgerOrNull()?.append({
-    op: "lifecycle",
-    collection: "",
-    id: "",
-    version: 0,
-    actor: "",
-    payloadHash: "",
-    reason: `partition-handed-over:${seal.sealId}`
-  });
-  const { name: vaultName } = vault._introspectState();
-  const backup = {
-    _noydb_backup: NOYDB_BACKUP_VERSION,
-    _compartment: vaultName,
-    _exported_at: (/* @__PURE__ */ new Date()).toISOString(),
-    _exported_by: "",
-    // unowned — no source user travels
-    keyrings: {},
-    collections,
-    ...hasInternal ? { _internal: internal } : {},
-    ...ledgerHead ? { ledgerHead: { hash: ledgerHead.hash, index: ledgerHead.index, ts: ledgerHead.ts } } : {}
-  };
-  const bodyJsonStr = JSON.stringify(buildExtractedPartitionWrapper(JSON.stringify(backup), seal));
-  const handle = generateULID();
-  const bundleBytes = await assembleBundleContainer({
-    handle,
-    bodyJsonStr,
-    compression: opts.compression,
-    headerExtras: {
-      bundleKind: "extracted-partition",
-      transferSeal: { v: seal.v, alg: seal.alg, sealId: seal.sealId }
-      // indicator only
-    }
-  });
-  return { bundleBytes, transferKey, sealId: seal.sealId };
-}
-
-export {
-  walkClosure,
-  reKeyClosure,
-  reKeySchemas,
-  reKeyLedger,
-  reKeyBlobs,
-  sealDeks,
-  extractPartition,
-  extractPartitionCore
-};
-//# sourceMappingURL=chunk-YMVQD5Q5.js.map

package/dist/chunk-YN5IAHN6.js

@@ -1,32 +0,0 @@
-// src/kernel/types.ts
-var NOYDB_FORMAT_VERSION = 1;
-var NOYDB_KEYRING_VERSION = 1;
-var NOYDB_BACKUP_VERSION = 1;
-var NOYDB_SYNC_VERSION = 1;
-var SealedHandle = class {
-  sealed = true;
-  #reveal;
-  constructor(reveal) {
-    this.#reveal = reveal;
-  }
-  reveal() {
-    return this.#reveal();
-  }
-  /** Non-leaking serialisation marker — never the underlying value. */
-  toJSON() {
-    return "[sealed]";
-  }
-};
-function createStore(factory) {
-  return factory;
-}
-
-export {
-  NOYDB_FORMAT_VERSION,
-  NOYDB_KEYRING_VERSION,
-  NOYDB_BACKUP_VERSION,
-  NOYDB_SYNC_VERSION,
-  SealedHandle,
-  createStore
-};
-//# sourceMappingURL=chunk-YN5IAHN6.js.map